CVE-2018-9987: Improper Neutralization of Input During Web Page Generation

In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications...

CVE-2018-9990: Improper Neutralization of Input During Web Page Generation

In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead...

PT-2018-19153

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 1.7.2 Description The issue is related to an XSS problem with stream names in topic typeahead. Recommendations For versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue...

PT-2018-19149

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 1.7.2 Description The issue is related to XSS problems with the frontend markdown processor. Recommendations For versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue...

Zulip Server invitation system unauthorized operation vulnerability

Zulip Server is a set of open source group chat application written in Python based on the Django framework. invitation system is one of the invitation system . A security vulnerability exists in the invitation system in Zulip Server versions prior to 1.7.1. An attacker can exploit this...

CVE-2017-0910

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm...

Design/Logic Flaw

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm...

CVE-2017-0910

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm...

CVE-2017-0910

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm...

CVE-2017-0910

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm...

CVE-2017-0910

Zulip Server (open-source group chat) before 1.7.1 contains an invitation-system vulnerability on multi-realm servers: an authorized user of one realm can create a user account on any other realm. Affected: Zulip Server versions prior to 1.7.1. Mitigation often cited as upgrading to 1.7.1 or appl...

PT-2017-10710

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 1.7.1 Description A vulnerability in the invitation system of Zulip Server allows an authorized user of one realm to create a user account on any other realm, given that the server has multiple realms...

CVE-2017-0910: Incorrect Authorization

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm...

Unspecified Vulnerability in Zulip Server

Zulip Server is a set of open source group chat application written in Python based on the Django framework . A security vulnerability exists in the implementation of the invitebyadminsonly setting in Zulip Server 1.5.1 and earlier versions. An attacker can exploit the vulnerability to invite oth...

Design/Logic Flaw

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invitebyadminsonly setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this...

CVE-2017-0896

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invitebyadminsonly setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this...

CVE-2017-0896

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invitebyadminsonly setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this...

CVE-2017-0896

Zulip Server 1.5.1 and earlier are affected by a flaw in the invite_by_admins_only setting. An authenticated user could invite others to join a Zulip organization even when the organization was configured to prevent this. The issue stems from how the setting is implemented in Zulip’s group chat s...

PT-2017-10697

Name of the Vulnerable Software and Affected Versions Zulip Server versions 1.5.1 and below Description The issue arises from an error in the implementation of the invite by admins only setting in the Zulip group chat application server. This error allows an authenticated user to invite other use...

CVE-2017-0896: Improper Authorization

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invitebyadminsonly setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this...